Why Every Service Should Get a Different Email Address

This week, Substack notified users that hackers stole their email addresses and phone numbers. The breach actually happened in October — they only discovered it now. A few days earlier, Betterment disclosed that 1.4 million accounts were exposed, including emails, names, and personal details.

These aren't exceptional events. They're Tuesday.

Every service you sign up for becomes a potential breach notification in your inbox. And your email address is the thread that connects them all. That LinkedIn breach? Same email as your bank. That random forum from 2019? Same email as your work account.

A practical alternative is to give every service its own email address.

Why Your Email Address Matters

Your email is the key to your digital identity. It's how you reset passwords, verify accounts, and prove who you are. It's also:

• A unique identifier that can be used to correlate your activity across services
• A phishing target once it's exposed in a breach
• Fuel for spam when it gets sold to data brokers
• A password reset vector if an attacker controls your inbox

When the same email appears in multiple breaches, attackers can build a profile. They know you have a Netflix account, use a particular bank, shop at certain stores. That makes phishing emails much more convincing.

Email Aliases: The Simple Solution

An email alias is an additional address that forwards to your real inbox. The magic: you can create a unique alias for every service.

Sign up for Substack? Use substack.7x9k@yourdomain.com.
Create a Reddit account? Use reddit.3m2f@yourdomain.com.
Register for an online store? Use store-name.8n4p@yourdomain.com.

All these addresses forward to your actual inbox. But if one gets breached, only that service is affected. You know exactly who leaked your data (because the alias tells you). And you can disable that single alias without touching anything else.

The Services That Make This Easy

You don't need your own domain or technical knowledge. Several services handle this automatically.

SimpleLogin

SimpleLogin is an open-source alias service owned by Proton. It works with an existing mailbox and supports custom domains on eligible plans.

• Create unlimited aliases with a few clicks
• Works with your existing email
• Browser extension for quick alias creation
• Open-source code
• GDPR-compliant

Plan limits and custom-domain support change over time, so check the current product page before choosing a tier.

Proton Pass

If you already use ProtonMail, Proton Pass includes "hide-my-email" aliases. It's integrated with their password manager, so new signups can automatically generate both a unique password and a unique email.

Firefox Relay

Mozilla offers Relay as a browser-integrated alias option. Current limits and paid features vary by region.

iCloud Hide My Email

Apple includes Hide My Email with eligible iCloud+ plans and can generate addresses during supported sign-up flows.

Fastmail Masked Email

Fastmail is an Australian email provider with excellent alias support. If you want to replace Gmail entirely with something private, this is a strong choice. Integrates with 1Password.

A workable setup

1. Choose a service — Prefer one that works with your current provider, publishes clear privacy terms, and lets you export or use a custom domain if portability matters.

2. Install the browser extension — On a signup form, one click can generate a unique alias.

3. Use a pattern that makes sense — A pattern such as servicename.randomchars@example.com identifies the recipient while random characters make aliases harder to guess.

4. Store aliases in a password manager — Keep each alias with its login entry so the address is easy to recover later.

5. Periodically review — Once or twice a year, disable aliases for services you no longer use.

What Happens When a Breach Occurs

This is where it pays off.

If a service gets breached, the response is contained:

1. Disable the compromised alias — The breached email stops receiving mail immediately. Phishing emails to that address go nowhere.

2. Create a new alias — For a service you still use, generate a fresh alias and update the account.

3. Watch for misuse — Spam or phishing sent to the old alias confirms that the address is being exploited.

4. Know who sold your data — Ever wonder which company gave your email to spammers? When each service has a unique alias, the mystery is solved.

Compare this to using one email everywhere: you'd change nothing, hope for the best, and deal with increased spam and phishing attempts forever.

The Realistic Approach

You don't have to go all-in immediately. Start with:

High-risk services first — Financial accounts, healthcare, government services. These hold the most sensitive data.

New signups from now on — Use aliases for everything you create going forward. No need to update old accounts unless you're motivated.

Gradually migrate important accounts — When you're changing a password anyway, update the email too.

Low-stakes stuff last — That random cooking website you signed up for once? Don't bother updating it. Just use aliases for new stuff.

What About Work?

This is primarily for personal accounts. Your work email is your work email — you can't alias that easily, and your IT department would have questions.

But for personal stuff — every streaming service, online store, forum, newsletter, social media account — there's no reason to use the same email.

The Phone Number Problem

Email aliases solve the email problem. But Substack also leaked phone numbers, and that's harder to address.

Some options:

• Use a VoIP number for services that demand phone verification
• Leave the phone field blank when it's optional
• Consider whether a service really needs your number

In the EU, GDPR's data minimisation principle means companies should only collect what they need. Many phone number requests are optional — check if the field is actually required.

Common Objections

"It's too much work" With a browser extension, it's literally one click. The password manager integration means you never have to remember which alias you used.

"What if I lose access to the alias service?" Export your aliases regularly. Most services let you download a list. Also: choose a reputable service that isn't going to vanish.

"Some services block alias domains" Occasionally true. For those, you have options: use a custom domain (SimpleLogin and others support this), or temporarily use your real email for that specific service.

"Won't they just look up my IP address?" Companies correlate data in many ways. Aliases aren't perfect anonymity — they're practical breach damage limitation. Perfect is the enemy of good.

Sources

• SimpleLogin documentation
• Proton Pass hide-my-email aliases
• Mozilla Firefox Relay
• Apple — Create and manage Hide My Email addresses
• Fastmail — Masked Email

The Bottom Line

Every email address you share is a liability waiting to happen. Every breach notification proves that services can't protect your data.

Using unique email aliases means:

• Breaches are contained to single services
• You always know who leaked your data
• Phishing becomes obvious (wrong alias = fake email)
• You can cut off a compromised address instantly

The setup takes 10 minutes. After that, it's one extra click per signup.

Next time you see "Enter your email," you'll have a choice: hand over the same address you've been giving everyone for years, or create a unique one that limits your exposure.

The services won't stop getting breached. But you can stop giving them the same key every time.